CVE-2013-4165: Infoleak
The HTTPAuthorized function in bitcoinrpc.cpp in bitcoind 0.8.1 provides information about authentication failure upon detecting the first incorrect byte of a password, which makes it easier for remote attackers to determine passwords via a timing side-channel attack.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4165?
CVE-2013-4165 is classified as a medium severity vulnerability due to its potential to allow remote attackers to exploit timing side-channel attacks.
How do I fix CVE-2013-4165?
To fix CVE-2013-4165, update to a version of Bitcoin Core later than 0.8.1 that addresses this authentication issue.
What vulnerabilities are associated with CVE-2013-4165?
CVE-2013-4165 specifically concerns a timing side-channel vulnerability related to password authentication in Bitcoin Core 0.8.1.
Who is affected by CVE-2013-4165?
All users running Bitcoin Core version 0.8.1 are affected by CVE-2013-4165.
What does CVE-2013-4165 exploit?
CVE-2013-4165 exploits the way the HTTPAuthorized function processes incorrect password attempts, leading to potential password disclosure.